Audit 297960

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-012 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE and UCX (7/1/2022 - 6/30/2023) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) ETA 2208A, Quarterly UI Above-Base Report - The ETA 2208A is a quarterly report of staff years worked and paid by program category. Reports are submitted electronically to the National Office by the 30th of the month following the close of the quarter. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Context: We reviewed a sample of the financial, performance, and special reports filed during FY 2023. The following exceptions were noted: ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 9055: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 2208A: One of two quarterly reports reviewed was submitted after the required due date. The report for the quarter ending 12/31/2022 was due by 1/30/2023 but was submitted on 2/3/2023, or four days late. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Performance and special reports were consistently submitted late. A lack of review and approval of reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial, performance, and special reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-005 Prior Year Finding: 2022-012 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE and UCX (7/1/2022 - 6/30/2023) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) ETA 2208A, Quarterly UI Above-Base Report - The ETA 2208A is a quarterly report of staff years worked and paid by program category. Reports are submitted electronically to the National Office by the 30th of the month following the close of the quarter. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Context: We reviewed a sample of the financial, performance, and special reports filed during FY 2023. The following exceptions were noted: ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 9055: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 2208A: One of two quarterly reports reviewed was submitted after the required due date. The report for the quarter ending 12/31/2022 was due by 1/30/2023 but was submitted on 2/3/2023, or four days late. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Performance and special reports were consistently submitted late. A lack of review and approval of reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial, performance, and special reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC (7/1/2022 – 6/30/2023) Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 26 CFR sections 31.3302(a)-3(a), states are required to annually certify for each taxpayer the total amount of contributions required to be paid under the state law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the Federal Unemployment Tax Act (FUTA). In order to accomplish this certification, states annually perform a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain the IRS 940 FUTA match data file and therefore, it was unavailable for testing by auditors. Context: FUTA match data was submitted to the IRS and proof of submission was retained for internal control purposes. However, since the match data file was not retained, auditors were unable to verify the accuracy of the match certification performed by the Department. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it retained the FUTA match data file and that this file was available for audit. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Auditors were unable to verify that the Department accurately performed a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Specifically, auditors were unable to verify that the taxable wages used by the Department agreed to the IRS matching result file, that timely and late payments were properly distinguished in the match results, and that the tax payment met the stated criteria for FUTA tax credits allowance. Questioned costs: Undetermined. Recommendation: We recommend the Department reviews and enhances its procedures and controls to ensure that it retains the IRS 940 FUTA match data file and this file is available for testing by auditors. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC (7/1/2022 – 6/30/2023) Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 26 CFR sections 31.3302(a)-3(a), states are required to annually certify for each taxpayer the total amount of contributions required to be paid under the state law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the Federal Unemployment Tax Act (FUTA). In order to accomplish this certification, states annually perform a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain the IRS 940 FUTA match data file and therefore, it was unavailable for testing by auditors. Context: FUTA match data was submitted to the IRS and proof of submission was retained for internal control purposes. However, since the match data file was not retained, auditors were unable to verify the accuracy of the match certification performed by the Department. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it retained the FUTA match data file and that this file was available for audit. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Auditors were unable to verify that the Department accurately performed a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Specifically, auditors were unable to verify that the taxable wages used by the Department agreed to the IRS matching result file, that timely and late payments were properly distinguished in the match results, and that the tax payment met the stated criteria for FUTA tax credits allowance. Questioned costs: Undetermined. Recommendation: We recommend the Department reviews and enhances its procedures and controls to ensure that it retains the IRS 940 FUTA match data file and this file is available for testing by auditors. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-007 Prior Year Finding: 2023-016 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For four of sixty general disbursement transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment to the vendor. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: None noted. The costs were determined to be allowable. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-007 Prior Year Finding: 2023-016 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For four of sixty general disbursement transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment to the vendor. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: None noted. The costs were determined to be allowable. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-008 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Payments were also issued without review and approval by supervisory staff. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2022 but costs, totaling $2,277, were incurred in June, July and September 2022. • The Department’s key control is that all payments are supported by an invoice approved by a program manager who is aware of the grant’s period of performance. Four of sixty transactions did not have evidence of supervisory approval prior to issuance of payment. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-008 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Payments were also issued without review and approval by supervisory staff. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2022 but costs, totaling $2,277, were incurred in June, July and September 2022. • The Department’s key control is that all payments are supported by an invoice approved by a program manager who is aware of the grant’s period of performance. Four of sixty transactions did not have evidence of supervisory approval prior to issuance of payment. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 – 12/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the U.S. Treasury’s Project and Expenditure Report User Guide, each State and Local Fiscal Recovery Fund (SLFRF) recipient is required to submit periodic reports with current performance and/or financial information including background information about the SLFRF projects that are the subjects of the reports; and financial information with details about obligations, expenditures, direct payments, and subawards. Financial information includes: a. Current period obligation b. Cumulative obligation c. Current period expenditure d. Cumulative expenditure Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Current period obligations reported did not agree to supporting documentation. Context: Two of four quarterly project and expenditure reports were selected for testing. The 12/31/2022 quarter included obligations and expenditures for 113 projects. Of the projects reported, supporting documentation indicated that 35 projects incurred current period obligations, but the Agency of Administration (Agency) reported $0 current period obligations for 34 of 35 projects. Thirty-four projects were incorrectly reported. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures over project and expenditure reporting were insufficient to ensure that financial information was reported accurately and tied to supporting documentation. The Agency utilizes upload templates to populate the Treasury reporting portal. When obligation and expenditure data was uploaded for the 12/31/2022 quarter, their procedures and controls did not detect that current period obligations had been incorrectly reported to the reporting portal. Effect: Current period obligation data was inaccurately reported to Treasury. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that financial information reported is accurate and ties to supporting documentation. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-021 Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – 2 CFR §200.332(a) - Requirements for Pass-Through Entities, states in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Required federal award information was omitted from subaward agreements issued using program funds. Context: The Agency of Administration (Agency) has oversight responsibility for Coronavirus State and Local Fiscal Recovery Funds expenditures and reporting for the State of Vermont (the State). Multiple agencies and departments within the State incur costs and issue subawards with program funding. Twenty-nine subrecipients were selected for testing, consisting of thirty-seven individual subawards issued by multiple agencies and departments. For 10 of 37 subaward agreements selected for testing, the Department of Public Service (Department) omitted the following required Federal information: • Federal Award Identification Number (FAIN) • Federal Award Date Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department did not establish effective internal controls and procedures over subrecipient monitoring. It was unable to ensure that it provided all required information to its subrecipients upon award issuance. The Agency’s oversight of the program did not detect the error. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: Undetermined. Recommendation: We recommend the Agency work with the Department to review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards. We further recommend that the Agency review its oversight procedures and controls to ensure that all State agencies and departments that issue subawards under the program are in compliance with federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Formula Grants for Rural Areas and Tribal Transit Program Assistance Listing Number: 20.509 Award Number and Year: VT2016-007-02 (9/23/2016 – 6/20/2023), VT-2017-007-01 (8/3/2017 – 6/21/2023), VT-2019-006-01 (9/20/2017 – 9/30/2022), VT-2020-005-00 (5/26/2020 – 9/30/2022), VT-2020-011-00 (9/9/2020 – 9/30/2023), VT-2020-012-00 (9/18/2020 – 9/30/2023), VT-2021-014-01 (9/20/2021 – 9/30/2023), VT-2022-001-02 (5/12/2022 – 6/30/2028) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Seven subawards were selected for testing and the following exceptions were noted: • For seven of seven subawards selected for testing, the FAIN and federal award date were not included on the subaward agreement. • For three of seven subawards selected for testing, the last on-site subrecipient monitoring visits were performed in FY 2020 and the next on-site monitoring is not scheduled to take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Formula Grants for Rural Areas and Tribal Transit Program Assistance Listing Number: 20.509 Award Number and Year: VT2016-007-02 (9/23/2016 – 6/20/2023), VT-2017-007-01 (8/3/2017 – 6/21/2023), VT-2019-006-01 (9/20/2017 – 9/30/2022), VT-2020-005-00 (5/26/2020 – 9/30/2022), VT-2020-011-00 (9/9/2020 – 9/30/2023), VT-2020-012-00 (9/18/2020 – 9/30/2023), VT-2021-014-01 (9/20/2021 – 9/30/2023), VT-2022-001-02 (5/12/2022 – 6/30/2028) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Seven subawards were selected for testing and the following exceptions were noted: • For seven of seven subawards selected for testing, the FAIN and federal award date were not included on the subaward agreement. • For three of seven subawards selected for testing, the last on-site subrecipient monitoring visits were performed in FY 2020 and the next on-site monitoring is not scheduled to take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For one of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Context: Nine subawards were selected for testing which included the original subawards and eighteen subaward amendments for a total of twenty-seven transactions tested. Specifically, the following exceptions were noted: • 7 of 27 subawards were not reported timely to FSRS. • 4 of 18 subaward amendments reported an incorrect amount to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-017 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (c) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (3) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) • For 3 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Eleven subawards were selected for testing which included seven initial subawards and four amendments. We noted the following exceptions: • Two of seven initial subawards were not reported to FSRS until after auditors requested samples for testing. • One of four amendments was not reported to FSRS. • Two of seven initial subawards were not reported to FSRS timely. The subawards were reported 28 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s internal controls were not operating sufficiently to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Two of the subaward exceptions were not reported to FSRS until after auditors had selected them for testing. In addition, the Agency noted that for Weatherization subawards, their internal procedure is to amend the total subaward amount at the end of the grant period, but the Agency does not report these amendments to FSRS. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Eleven subawards were selected for testing which included seven initial subawards and four amendments. We noted the following exceptions: • Two of seven initial subawards were not reported to FSRS until after auditors requested samples for testing. • One of four amendments was not reported to FSRS. • Two of seven initial subawards were not reported to FSRS timely. The subawards were reported 28 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s internal controls were not operating sufficiently to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Two of the subaward exceptions were not reported to FSRS until after auditors had selected them for testing. In addition, the Agency noted that for Weatherization subawards, their internal procedure is to amend the total subaward amount at the end of the grant period, but the Agency does not report these amendments to FSRS. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLWC6 (5/28/2021 – 9/30/2023) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The SF-425 Federal Financial Report is due annually no later than December 31st via the Payment Management System (PMS). This report concerns the obligation balances for each federal fiscal year and for each type of Low-Income Home Energy Assistance Program (LIHEAP) grant award (block grants, reallotment, emergency contingency, Leveraging, and REACH). A report is required from those recipients expending up to 5 percent of funds under section 2605(b)(16) (42 USC 8624(b)(16)). Low Income Household Water Assistance Program (LIHWAP) recipients must track, account for, and report on, the LIHWAP funding separate from the rest of their funding. The Office of Community Services provided guidance to LIHWAP grant recipients of an extension to the annual report deadline for reports for the period ending September 30, 2022. The due date for this report was extended to no later than January 30, 2023. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not submit the annual SF-425 Federal Financial Report for the 2021 LIHWAP award by the January 30, 2023 extended due date. Context: Five annual SF-425 Federal Financial Reports were selected for testing, and we noted that one of five reports was not submitted timely. The 2021 LIHWAP annual report for the period ending September 30, 2022 was due no later than January 30, 2023 but was not submitted until February 24, 2023, or 25 days late. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and controls were insufficient to ensure that annual Federal Financial reports were filed timely. Effect: Untimely filing of annual reports could impact the federal agency’s ability to monitor the program. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required annual reports are filed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLWC6 (5/28/2021 – 9/30/2023) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The SF-425 Federal Financial Report is due annually no later than December 31st via the Payment Management System (PMS). This report concerns the obligation balances for each federal fiscal year and for each type of Low-Income Home Energy Assistance Program (LIHEAP) grant award (block grants, reallotment, emergency contingency, Leveraging, and REACH). A report is required from those recipients expending up to 5 percent of funds under section 2605(b)(16) (42 USC 8624(b)(16)). Low Income Household Water Assistance Program (LIHWAP) recipients must track, account for, and report on, the LIHWAP funding separate from the rest of their funding. The Office of Community Services provided guidance to LIHWAP grant recipients of an extension to the annual report deadline for reports for the period ending September 30, 2022. The due date for this report was extended to no later than January 30, 2023. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not submit the annual SF-425 Federal Financial Report for the 2021 LIHWAP award by the January 30, 2023 extended due date. Context: Five annual SF-425 Federal Financial Reports were selected for testing, and we noted that one of five reports was not submitted timely. The 2021 LIHWAP annual report for the period ending September 30, 2022 was due no later than January 30, 2023 but was not submitted until February 24, 2023, or 25 days late. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and controls were insufficient to ensure that annual Federal Financial reports were filed timely. Effect: Untimely filing of annual reports could impact the federal agency’s ability to monitor the program. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required annual reports are filed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Low-Income Home Energy Assistance COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: None. The error did not result in an unallowable federal interest liability. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Low-Income Home Energy Assistance COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: None. The error did not result in an unallowable federal interest liability. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: Four of eight subawards selected for testing were not reported to FSRS in accordance with FFATA requirements. Specifically, we noted the following exceptions: • Three of eight subawards were not reported to FSRS until after auditors requested samples for testing. The subawards were issued between 12/31/2021 and 4/1/2022 but were not reported to FSRS until 10/31/2023. • One of eight subawards was not reported to FSRS timely. The subaward should have been reported to FSRS by 3/31/2022, but it was not reported until 4/22/2022, or 22 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Internal controls did not detect or prevent the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that a cost analysis was performed for a procurement action in excess of the Simplified Acquisition Threshold. Context: For one of seven contracts selected for testing, the Agency was unable to provide documentation that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that a cost analysis was performed for all procurement actions in excess of the Simplified Acquisition Threshold. Internal controls did not detect or prevent the error. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Failure to perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it performs a cost analysis for all procurement actions in excess of the Simplified Acquisition Threshold, including contract modifications. We further recommend that cost analysis documentation is maintained and readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2201VTADPT (7/1/2022 – 9/30/2022), 2301VTADPT (10/1/2022 – 6/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 USC 673, each State shall enter into adoption assistance agreements (as defined in section 675(3)) with the adoptive parents of children with special needs in accordance with its approved State plan. Adoption assistance subsidy payments may be paid on behalf of a child only if they are determined to meet the program’s eligibility requirements: • Categorical Eligibility – The child meets the definition of an “applicable or non-applicable child” and meets the corresponding eligibility requirements per 42 USC 673. • The child was determined by the Title IV-E agency as someone who cannot or should not be returned to the home of his or her parents (42 USC 673(c)(1)). • The child was determined by the Title IV-E agency to be a child with special needs. • The Title IV-E agency has made reasonable efforts to place the child for adoption without a subsidy. • The agreement for the subsidy was signed and was in effect before the final decree of adoption and contains information concerning the nature of services; the amount and duration of the subsidy; the child’s eligibility for Title XX services and Title XIX Medicaid; and covers the child should he/she move out of state with the adoptive family (42 USC 675(3)). • The prospective adoptive parent(s) must satisfactorily have met a criminal records check, including a fingerprint-based check (42 USC 671(a)(20)(A)). • The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. • Once a child is determined eligible to receive Title IV-E adoption assistance, he or she remains eligible and the subsidy continues until the age of 18 (or 21 if the Title IV-E agency determines that the child has a mental or physical disability which warrants the continuation of assistance). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Findings and Questioned Costs – Major Federal Programs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that participants receiving benefits under the program met eligibility requirements. Context: For two of forty participants selected for testing, the Agency was unable to provide documentation that the children were eligible for the program. Specifically, we noted the following exceptions: • For one of forty participants, documentation could not be provided that the child was eligible for the program. • For one of forty participants, the child turned eighteen on 3/26/2022 but remained in the program until 6/10/2023. Documentation could not be provided for the continuation of benefits after the child’s 18th birthday. Cause: The Agency’s procedures were not sufficient to ensure that documentation was maintained that participants were eligible to participate in the program. Internal controls did not detect or prevent the errors. Effect Subsidy payments were made on behalf of children that were not eligible for the program. Questioned costs: $16,362, the federal share of subsidy payments made during FY 2023 for ineligible participants. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility documentation is maintained for all program participants and that it is readily available for audit. We further recommend that the Agency review and enhance procedures and controls for children turning eighteen to ensure that benefits are terminated on a timely basis or that a determination is made and documented if the child has a mental or physical disability which warrants the continuation of assistance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-035 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2205VT5021 (10/1/2021 – 9/30/2023) 2305VT5021 (10/1/2022 – 9/30/2024) 2305VT3002 (10/1/2022 – 9/30/2024) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 457.380 and state requirements (as documented in the CHIP state plan, verification plan, and eligibility manual). The state is required (as described at 42 CFR 457.965) to maintain facts in the case file to support the eligibility determination. The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with sections 457.315, 457.348, and 457.350. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) terminated benefits for a CHIP participant without providing notification to the participant. Context: For one of sixty CHIP participants selected for testing, the Agency performed a recertification on 6/9/2023 to determine if the participant should be moved to the Medicaid program. On 6/30/2023, while the income verification was pending, the participant was removed from CHIP benefits without notification. Cause: The Agency did not adequately follow procedures regarding eligibility in accordance with federal program requirements. Internal controls did not detect or prevent the error. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect A participant’s benefits were terminated without proper notification. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for CHIP beneficiary eligibility determinations to ensure that it provides adequate written notice of any decision affecting a participant’s eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with program regulations. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: 2022-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2205VT5021 (10/1/2021 – 9/30/2023) 2305VT5021 (10/1/2022 – 9/30/2024) 2305VT3002 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions - Provider Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: In order to receive CHIP payments, CHIP providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program (42 CFR 457.900); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR 457.990(a), cross referencing 455.107). CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support provider eligibility to participate in the CHIP program. Documentation of the providers’ tax standing was not maintained in the Provider Management Module (PMM). Context: For five of sixty providers selected for testing, documentation was incomplete to support that the providers were in good tax standing. The provider eligibility requirement is administered by a 3rd-party that determines and documents each provider’s eligibility with the Agency’s requirements. For the exceptions noted, the provider files in PMM did not contain a copy of the tax standing letter. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency did not adequately follow procedures regarding documentation of CHIP provider eligibility in accordance with federal program requirements. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: The Agency was unable to support provider eligibility or consistent application of their internal control process. Failure to maintain complete provider files could allow program payments to be made to an ineligible provider. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with the federal program requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse; COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI084611 (10/1/2021 – 9/30/2024), B08TI083971 (9/1/2021 – 9/30/2025), B08TI083516 (3/15/2021 – 3/14/2023), B08TI083480 (10/1/2020 – 9/30/2022), B08TI084675 (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Thirteen subawards were selected for testing which included eight initial subawards and five amendments. We noted the following exceptions: • One of five amendments was not reported to FSRS. • Two of eight initial subawards were not reported to FSRS timely. The subawards were reported 22 and 29 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse; COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI084611 (10/1/2021 – 9/30/2024), B08TI083971 (9/1/2021 – 9/30/2025), B08TI083516 (3/15/2021 – 3/14/2023), B08TI083480 (10/1/2020 – 9/30/2022), B08TI084675 (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Thirteen subawards were selected for testing which included eight initial subawards and five amendments. We noted the following exceptions: • One of five amendments was not reported to FSRS. • Two of eight initial subawards were not reported to FSRS timely. The subawards were reported 22 and 29 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-034 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Public Safety Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4445-DR-VT (2019), FEMA-4474-DR-VT (2020), FEMA-4532-DR-VT (2020), FEMA-4621-DR-VT (2021) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Safety (Department) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Forty-four subawards were selected for testing which included eight subawards and thirty-six amendments. Of the forty-four subawards selected, only one subaward, in the amount of $58,542, was reported timely and accurately. Specifically, the following exceptions were noted: • 38 of 44 subawards were not reported to FSRS, totaling $17,901,902. • 1 of 44 subawards was not reported timely to FSRS, totaling $9,609,432. • 4 of 44 subawards reported an incorrect amount to FSRS, with a net reported variance of $155,342. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported timely or accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: The Department’s subaward reporting to FSRS was incomplete and inaccurate. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards and subaward modifications are reported accurately and timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award should be reported as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the Department must continue to report the subaward, including grant modifications. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-012 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE and UCX (7/1/2022 - 6/30/2023) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) ETA 2208A, Quarterly UI Above-Base Report - The ETA 2208A is a quarterly report of staff years worked and paid by program category. Reports are submitted electronically to the National Office by the 30th of the month following the close of the quarter. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Context: We reviewed a sample of the financial, performance, and special reports filed during FY 2023. The following exceptions were noted: ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 9055: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 2208A: One of two quarterly reports reviewed was submitted after the required due date. The report for the quarter ending 12/31/2022 was due by 1/30/2023 but was submitted on 2/3/2023, or four days late. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Performance and special reports were consistently submitted late. A lack of review and approval of reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial, performance, and special reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-005 Prior Year Finding: 2022-012 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE and UCX (7/1/2022 - 6/30/2023) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) ETA 2208A, Quarterly UI Above-Base Report - The ETA 2208A is a quarterly report of staff years worked and paid by program category. Reports are submitted electronically to the National Office by the 30th of the month following the close of the quarter. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Context: We reviewed a sample of the financial, performance, and special reports filed during FY 2023. The following exceptions were noted: ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 9055: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 2208A: One of two quarterly reports reviewed was submitted after the required due date. The report for the quarter ending 12/31/2022 was due by 1/30/2023 but was submitted on 2/3/2023, or four days late. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Performance and special reports were consistently submitted late. A lack of review and approval of reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial, performance, and special reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC (7/1/2022 – 6/30/2023) Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 26 CFR sections 31.3302(a)-3(a), states are required to annually certify for each taxpayer the total amount of contributions required to be paid under the state law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the Federal Unemployment Tax Act (FUTA). In order to accomplish this certification, states annually perform a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain the IRS 940 FUTA match data file and therefore, it was unavailable for testing by auditors. Context: FUTA match data was submitted to the IRS and proof of submission was retained for internal control purposes. However, since the match data file was not retained, auditors were unable to verify the accuracy of the match certification performed by the Department. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it retained the FUTA match data file and that this file was available for audit. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Auditors were unable to verify that the Department accurately performed a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Specifically, auditors were unable to verify that the taxable wages used by the Department agreed to the IRS matching result file, that timely and late payments were properly distinguished in the match results, and that the tax payment met the stated criteria for FUTA tax credits allowance. Questioned costs: Undetermined. Recommendation: We recommend the Department reviews and enhances its procedures and controls to ensure that it retains the IRS 940 FUTA match data file and this file is available for testing by auditors. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC (7/1/2022 – 6/30/2023) Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 26 CFR sections 31.3302(a)-3(a), states are required to annually certify for each taxpayer the total amount of contributions required to be paid under the state law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the Federal Unemployment Tax Act (FUTA). In order to accomplish this certification, states annually perform a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain the IRS 940 FUTA match data file and therefore, it was unavailable for testing by auditors. Context: FUTA match data was submitted to the IRS and proof of submission was retained for internal control purposes. However, since the match data file was not retained, auditors were unable to verify the accuracy of the match certification performed by the Department. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it retained the FUTA match data file and that this file was available for audit. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Auditors were unable to verify that the Department accurately performed a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Specifically, auditors were unable to verify that the taxable wages used by the Department agreed to the IRS matching result file, that timely and late payments were properly distinguished in the match results, and that the tax payment met the stated criteria for FUTA tax credits allowance. Questioned costs: Undetermined. Recommendation: We recommend the Department reviews and enhances its procedures and controls to ensure that it retains the IRS 940 FUTA match data file and this file is available for testing by auditors. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-007 Prior Year Finding: 2023-016 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For four of sixty general disbursement transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment to the vendor. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: None noted. The costs were determined to be allowable. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-007 Prior Year Finding: 2023-016 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For four of sixty general disbursement transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment to the vendor. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: None noted. The costs were determined to be allowable. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-008 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Payments were also issued without review and approval by supervisory staff. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2022 but costs, totaling $2,277, were incurred in June, July and September 2022. • The Department’s key control is that all payments are supported by an invoice approved by a program manager who is aware of the grant’s period of performance. Four of sixty transactions did not have evidence of supervisory approval prior to issuance of payment. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-008 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Payments were also issued without review and approval by supervisory staff. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2022 but costs, totaling $2,277, were incurred in June, July and September 2022. • The Department’s key control is that all payments are supported by an invoice approved by a program manager who is aware of the grant’s period of performance. Four of sixty transactions did not have evidence of supervisory approval prior to issuance of payment. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 – 12/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the U.S. Treasury’s Project and Expenditure Report User Guide, each State and Local Fiscal Recovery Fund (SLFRF) recipient is required to submit periodic reports with current performance and/or financial information including background information about the SLFRF projects that are the subjects of the reports; and financial information with details about obligations, expenditures, direct payments, and subawards. Financial information includes: a. Current period obligation b. Cumulative obligation c. Current period expenditure d. Cumulative expenditure Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Current period obligations reported did not agree to supporting documentation. Context: Two of four quarterly project and expenditure reports were selected for testing. The 12/31/2022 quarter included obligations and expenditures for 113 projects. Of the projects reported, supporting documentation indicated that 35 projects incurred current period obligations, but the Agency of Administration (Agency) reported $0 current period obligations for 34 of 35 projects. Thirty-four projects were incorrectly reported. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures over project and expenditure reporting were insufficient to ensure that financial information was reported accurately and tied to supporting documentation. The Agency utilizes upload templates to populate the Treasury reporting portal. When obligation and expenditure data was uploaded for the 12/31/2022 quarter, their procedures and controls did not detect that current period obligations had been incorrectly reported to the reporting portal. Effect: Current period obligation data was inaccurately reported to Treasury. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that financial information reported is accurate and ties to supporting documentation. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-021 Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – 2 CFR §200.332(a) - Requirements for Pass-Through Entities, states in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Required federal award information was omitted from subaward agreements issued using program funds. Context: The Agency of Administration (Agency) has oversight responsibility for Coronavirus State and Local Fiscal Recovery Funds expenditures and reporting for the State of Vermont (the State). Multiple agencies and departments within the State incur costs and issue subawards with program funding. Twenty-nine subrecipients were selected for testing, consisting of thirty-seven individual subawards issued by multiple agencies and departments. For 10 of 37 subaward agreements selected for testing, the Department of Public Service (Department) omitted the following required Federal information: • Federal Award Identification Number (FAIN) • Federal Award Date Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department did not establish effective internal controls and procedures over subrecipient monitoring. It was unable to ensure that it provided all required information to its subrecipients upon award issuance. The Agency’s oversight of the program did not detect the error. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: Undetermined. Recommendation: We recommend the Agency work with the Department to review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards. We further recommend that the Agency review its oversight procedures and controls to ensure that all State agencies and departments that issue subawards under the program are in compliance with federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Formula Grants for Rural Areas and Tribal Transit Program Assistance Listing Number: 20.509 Award Number and Year: VT2016-007-02 (9/23/2016 – 6/20/2023), VT-2017-007-01 (8/3/2017 – 6/21/2023), VT-2019-006-01 (9/20/2017 – 9/30/2022), VT-2020-005-00 (5/26/2020 – 9/30/2022), VT-2020-011-00 (9/9/2020 – 9/30/2023), VT-2020-012-00 (9/18/2020 – 9/30/2023), VT-2021-014-01 (9/20/2021 – 9/30/2023), VT-2022-001-02 (5/12/2022 – 6/30/2028) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Seven subawards were selected for testing and the following exceptions were noted: • For seven of seven subawards selected for testing, the FAIN and federal award date were not included on the subaward agreement. • For three of seven subawards selected for testing, the last on-site subrecipient monitoring visits were performed in FY 2020 and the next on-site monitoring is not scheduled to take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Formula Grants for Rural Areas and Tribal Transit Program Assistance Listing Number: 20.509 Award Number and Year: VT2016-007-02 (9/23/2016 – 6/20/2023), VT-2017-007-01 (8/3/2017 – 6/21/2023), VT-2019-006-01 (9/20/2017 – 9/30/2022), VT-2020-005-00 (5/26/2020 – 9/30/2022), VT-2020-011-00 (9/9/2020 – 9/30/2023), VT-2020-012-00 (9/18/2020 – 9/30/2023), VT-2021-014-01 (9/20/2021 – 9/30/2023), VT-2022-001-02 (5/12/2022 – 6/30/2028) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Seven subawards were selected for testing and the following exceptions were noted: • For seven of seven subawards selected for testing, the FAIN and federal award date were not included on the subaward agreement. • For three of seven subawards selected for testing, the last on-site subrecipient monitoring visits were performed in FY 2020 and the next on-site monitoring is not scheduled to take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For one of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Context: Nine subawards were selected for testing which included the original subawards and eighteen subaward amendments for a total of twenty-seven transactions tested. Specifically, the following exceptions were noted: • 7 of 27 subawards were not reported timely to FSRS. • 4 of 18 subaward amendments reported an incorrect amount to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-017 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (c) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (3) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) • For 3 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Eleven subawards were selected for testing which included seven initial subawards and four amendments. We noted the following exceptions: • Two of seven initial subawards were not reported to FSRS until after auditors requested samples for testing. • One of four amendments was not reported to FSRS. • Two of seven initial subawards were not reported to FSRS timely. The subawards were reported 28 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s internal controls were not operating sufficiently to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Two of the subaward exceptions were not reported to FSRS until after auditors had selected them for testing. In addition, the Agency noted that for Weatherization subawards, their internal procedure is to amend the total subaward amount at the end of the grant period, but the Agency does not report these amendments to FSRS. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Eleven subawards were selected for testing which included seven initial subawards and four amendments. We noted the following exceptions: • Two of seven initial subawards were not reported to FSRS until after auditors requested samples for testing. • One of four amendments was not reported to FSRS. • Two of seven initial subawards were not reported to FSRS timely. The subawards were reported 28 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s internal controls were not operating sufficiently to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Two of the subaward exceptions were not reported to FSRS until after auditors had selected them for testing. In addition, the Agency noted that for Weatherization subawards, their internal procedure is to amend the total subaward amount at the end of the grant period, but the Agency does not report these amendments to FSRS. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLWC6 (5/28/2021 – 9/30/2023) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The SF-425 Federal Financial Report is due annually no later than December 31st via the Payment Management System (PMS). This report concerns the obligation balances for each federal fiscal year and for each type of Low-Income Home Energy Assistance Program (LIHEAP) grant award (block grants, reallotment, emergency contingency, Leveraging, and REACH). A report is required from those recipients expending up to 5 percent of funds under section 2605(b)(16) (42 USC 8624(b)(16)). Low Income Household Water Assistance Program (LIHWAP) recipients must track, account for, and report on, the LIHWAP funding separate from the rest of their funding. The Office of Community Services provided guidance to LIHWAP grant recipients of an extension to the annual report deadline for reports for the period ending September 30, 2022. The due date for this report was extended to no later than January 30, 2023. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not submit the annual SF-425 Federal Financial Report for the 2021 LIHWAP award by the January 30, 2023 extended due date. Context: Five annual SF-425 Federal Financial Reports were selected for testing, and we noted that one of five reports was not submitted timely. The 2021 LIHWAP annual report for the period ending September 30, 2022 was due no later than January 30, 2023 but was not submitted until February 24, 2023, or 25 days late. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and controls were insufficient to ensure that annual Federal Financial reports were filed timely. Effect: Untimely filing of annual reports could impact the federal agency’s ability to monitor the program. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required annual reports are filed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLWC6 (5/28/2021 – 9/30/2023) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The SF-425 Federal Financial Report is due annually no later than December 31st via the Payment Management System (PMS). This report concerns the obligation balances for each federal fiscal year and for each type of Low-Income Home Energy Assistance Program (LIHEAP) grant award (block grants, reallotment, emergency contingency, Leveraging, and REACH). A report is required from those recipients expending up to 5 percent of funds under section 2605(b)(16) (42 USC 8624(b)(16)). Low Income Household Water Assistance Program (LIHWAP) recipients must track, account for, and report on, the LIHWAP funding separate from the rest of their funding. The Office of Community Services provided guidance to LIHWAP grant recipients of an extension to the annual report deadline for reports for the period ending September 30, 2022. The due date for this report was extended to no later than January 30, 2023. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not submit the annual SF-425 Federal Financial Report for the 2021 LIHWAP award by the January 30, 2023 extended due date. Context: Five annual SF-425 Federal Financial Reports were selected for testing, and we noted that one of five reports was not submitted timely. The 2021 LIHWAP annual report for the period ending September 30, 2022 was due no later than January 30, 2023 but was not submitted until February 24, 2023, or 25 days late. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and controls were insufficient to ensure that annual Federal Financial reports were filed timely. Effect: Untimely filing of annual reports could impact the federal agency’s ability to monitor the program. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required annual reports are filed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Low-Income Home Energy Assistance COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: None. The error did not result in an unallowable federal interest liability. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Low-Income Home Energy Assistance COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: None. The error did not result in an unallowable federal interest liability. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: Four of eight subawards selected for testing were not reported to FSRS in accordance with FFATA requirements. Specifically, we noted the following exceptions: • Three of eight subawards were not reported to FSRS until after auditors requested samples for testing. The subawards were issued between 12/31/2021 and 4/1/2022 but were not reported to FSRS until 10/31/2023. • One of eight subawards was not reported to FSRS timely. The subaward should have been reported to FSRS by 3/31/2022, but it was not reported until 4/22/2022, or 22 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Internal controls did not detect or prevent the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that a cost analysis was performed for a procurement action in excess of the Simplified Acquisition Threshold. Context: For one of seven contracts selected for testing, the Agency was unable to provide documentation that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that a cost analysis was performed for all procurement actions in excess of the Simplified Acquisition Threshold. Internal controls did not detect or prevent the error. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Failure to perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it performs a cost analysis for all procurement actions in excess of the Simplified Acquisition Threshold, including contract modifications. We further recommend that cost analysis documentation is maintained and readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2201VTADPT (7/1/2022 – 9/30/2022), 2301VTADPT (10/1/2022 – 6/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 USC 673, each State shall enter into adoption assistance agreements (as defined in section 675(3)) with the adoptive parents of children with special needs in accordance with its approved State plan. Adoption assistance subsidy payments may be paid on behalf of a child only if they are determined to meet the program’s eligibility requirements: • Categorical Eligibility – The child meets the definition of an “applicable or non-applicable child” and meets the corresponding eligibility requirements per 42 USC 673. • The child was determined by the Title IV-E agency as someone who cannot or should not be returned to the home of his or her parents (42 USC 673(c)(1)). • The child was determined by the Title IV-E agency to be a child with special needs. • The Title IV-E agency has made reasonable efforts to place the child for adoption without a subsidy. • The agreement for the subsidy was signed and was in effect before the final decree of adoption and contains information concerning the nature of services; the amount and duration of the subsidy; the child’s eligibility for Title XX services and Title XIX Medicaid; and covers the child should he/she move out of state with the adoptive family (42 USC 675(3)). • The prospective adoptive parent(s) must satisfactorily have met a criminal records check, including a fingerprint-based check (42 USC 671(a)(20)(A)). • The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. • Once a child is determined eligible to receive Title IV-E adoption assistance, he or she remains eligible and the subsidy continues until the age of 18 (or 21 if the Title IV-E agency determines that the child has a mental or physical disability which warrants the continuation of assistance). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Findings and Questioned Costs – Major Federal Programs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that participants receiving benefits under the program met eligibility requirements. Context: For two of forty participants selected for testing, the Agency was unable to provide documentation that the children were eligible for the program. Specifically, we noted the following exceptions: • For one of forty participants, documentation could not be provided that the child was eligible for the program. • For one of forty participants, the child turned eighteen on 3/26/2022 but remained in the program until 6/10/2023. Documentation could not be provided for the continuation of benefits after the child’s 18th birthday. Cause: The Agency’s procedures were not sufficient to ensure that documentation was maintained that participants were eligible to participate in the program. Internal controls did not detect or prevent the errors. Effect Subsidy payments were made on behalf of children that were not eligible for the program. Questioned costs: $16,362, the federal share of subsidy payments made during FY 2023 for ineligible participants. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility documentation is maintained for all program participants and that it is readily available for audit. We further recommend that the Agency review and enhance procedures and controls for children turning eighteen to ensure that benefits are terminated on a timely basis or that a determination is made and documented if the child has a mental or physical disability which warrants the continuation of assistance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-035 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2205VT5021 (10/1/2021 – 9/30/2023) 2305VT5021 (10/1/2022 – 9/30/2024) 2305VT3002 (10/1/2022 – 9/30/2024) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 457.380 and state requirements (as documented in the CHIP state plan, verification plan, and eligibility manual). The state is required (as described at 42 CFR 457.965) to maintain facts in the case file to support the eligibility determination. The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with sections 457.315, 457.348, and 457.350. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) terminated benefits for a CHIP participant without providing notification to the participant. Context: For one of sixty CHIP participants selected for testing, the Agency performed a recertification on 6/9/2023 to determine if the participant should be moved to the Medicaid program. On 6/30/2023, while the income verification was pending, the participant was removed from CHIP benefits without notification. Cause: The Agency did not adequately follow procedures regarding eligibility in accordance with federal program requirements. Internal controls did not detect or prevent the error. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect A participant’s benefits were terminated without proper notification. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for CHIP beneficiary eligibility determinations to ensure that it provides adequate written notice of any decision affecting a participant’s eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with program regulations. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: 2022-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2205VT5021 (10/1/2021 – 9/30/2023) 2305VT5021 (10/1/2022 – 9/30/2024) 2305VT3002 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions - Provider Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: In order to receive CHIP payments, CHIP providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program (42 CFR 457.900); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR 457.990(a), cross referencing 455.107). CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support provider eligibility to participate in the CHIP program. Documentation of the providers’ tax standing was not maintained in the Provider Management Module (PMM). Context: For five of sixty providers selected for testing, documentation was incomplete to support that the providers were in good tax standing. The provider eligibility requirement is administered by a 3rd-party that determines and documents each provider’s eligibility with the Agency’s requirements. For the exceptions noted, the provider files in PMM did not contain a copy of the tax standing letter. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency did not adequately follow procedures regarding documentation of CHIP provider eligibility in accordance with federal program requirements. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: The Agency was unable to support provider eligibility or consistent application of their internal control process. Failure to maintain complete provider files could allow program payments to be made to an ineligible provider. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with the federal program requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse; COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI084611 (10/1/2021 – 9/30/2024), B08TI083971 (9/1/2021 – 9/30/2025), B08TI083516 (3/15/2021 – 3/14/2023), B08TI083480 (10/1/2020 – 9/30/2022), B08TI084675 (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Thirteen subawards were selected for testing which included eight initial subawards and five amendments. We noted the following exceptions: • One of five amendments was not reported to FSRS. • Two of eight initial subawards were not reported to FSRS timely. The subawards were reported 22 and 29 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse; COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI084611 (10/1/2021 – 9/30/2024), B08TI083971 (9/1/2021 – 9/30/2025), B08TI083516 (3/15/2021 – 3/14/2023), B08TI083480 (10/1/2020 – 9/30/2022), B08TI084675 (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Thirteen subawards were selected for testing which included eight initial subawards and five amendments. We noted the following exceptions: • One of five amendments was not reported to FSRS. • Two of eight initial subawards were not reported to FSRS timely. The subawards were reported 22 and 29 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-034 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Public Safety Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4445-DR-VT (2019), FEMA-4474-DR-VT (2020), FEMA-4532-DR-VT (2020), FEMA-4621-DR-VT (2021) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Safety (Department) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Forty-four subawards were selected for testing which included eight subawards and thirty-six amendments. Of the forty-four subawards selected, only one subaward, in the amount of $58,542, was reported timely and accurately. Specifically, the following exceptions were noted: • 38 of 44 subawards were not reported to FSRS, totaling $17,901,902. • 1 of 44 subawards was not reported timely to FSRS, totaling $9,609,432. • 4 of 44 subawards reported an incorrect amount to FSRS, with a net reported variance of $155,342. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported timely or accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: The Department’s subaward reporting to FSRS was incomplete and inaccurate. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards and subaward modifications are reported accurately and timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award should be reported as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the Department must continue to report the subaward, including grant modifications. Views of responsible officials: Management agrees with the finding.